I realize that these are both hardware vulnerabilities but wanted to know. out of the data we are able to collect with splunk, what specific metrics would be the best to monitor as they directly correlate to Meltdown and Spectre behavior? From what I have been reading from the white papers, it's extremely difficult/ impossible to determine if this attack has been executed in your environment.
Any insight or recommendations are greatly appreciated.
-iKF
depends on what you currently have with Splunk ? are you ingesting from vulnerability management tools ?
If you have Splunk ES you could use that to look for the vunerabilities as per this article here :
https://www.linkedin.com/pulse/splunking-apache-struts-vulnerabilities-exploits-love-ken-westin/
Spectre:
CVE-2017-5753: bounds check bypass
CVE-2017-5715: branch target injection
Meltdown:
CVE-2017-5754: rogue data cache load
So something like ..
tag=vulnerability (cve=" CVE-2017-5753" OR cve=" CVE-2017-5715" OR cve=" CVE-2017-5754")
| table src cve pluginName first_found last_found last_fixed
| dedup src
| fillnull value=NOT_FIXED last_fixed
| search last_fixed=NOT_FIXED
| stats count as total
depends on what you currently have with Splunk ? are you ingesting from vulnerability management tools ?
If you have Splunk ES you could use that to look for the vunerabilities as per this article here :
https://www.linkedin.com/pulse/splunking-apache-struts-vulnerabilities-exploits-love-ken-westin/
Spectre:
CVE-2017-5753: bounds check bypass
CVE-2017-5715: branch target injection
Meltdown:
CVE-2017-5754: rogue data cache load
So something like ..
tag=vulnerability (cve=" CVE-2017-5753" OR cve=" CVE-2017-5715" OR cve=" CVE-2017-5754")
| table src cve pluginName first_found last_found last_fixed
| dedup src
| fillnull value=NOT_FIXED last_fixed
| search last_fixed=NOT_FIXED
| stats count as total
Excellent, Thank you so much!